The One-Control Test: How to Judge a CMMC Software Vendor Demo in 30 Minutes

A CMMC software vendor demo almost always starts with a dashboard: a score gauge, a donut chart of controls by family, a progress bar. None of that tells you whether the tool will produce documents an assessor, a prime or your own affirming official can rely on. The fastest way to find out is to ignore the dashboard and ask the vendor to walk one requirement all the way through, from explanation to finished output.

We call it the one-control test. Pick NIST SP 800-171 requirement 3.5.3, multifactor authentication (MFA), and ask the vendor to show it five ways in the tool: what it means, the system security plan (SSP) paragraph, the policy statement, the evidence, and the export. Thirty minutes, one requirement, and you will know more than any feature list tells you. This post explains why that requirement, what good output looks like at each step, and what to write down.

Why one control beats a full CMMC software vendor demo

A demo is built to show breadth. The vendor clicks through families, shows that all 110 requirements are loaded, and shows a report. Breadth is easy: every tool on the market has the 110 requirements of NIST SP 800-171 Revision 2 in a table. What separates tools is depth on a single requirement, because that is where your time goes after you buy.

Depth is also where the risk sits. When you post a score in the Supplier Performance Risk System (SPRS) or affirm a CMMC Level 1 (Self) or Level 2 (Self) status, a senior official at your company is attesting that the requirements are implemented. If the software marked something implemented that was not, the software does not sign the affirmation. You do. Our post on the affirming official covers what that person is attesting to.

Why 3.5.3 is the right requirement to test

Requirement 3.5.3 reads: use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. It is a good test for four reasons.

• It has four assessment objectives. NIST SP 800-171A splits it into [a] privileged accounts are identified, [b] MFA for local access to privileged accounts, [c] MFA for network access to privileged accounts, and [d] MFA for network access to non-privileged accounts. A tool that treats it as one checkbox fails immediately.
• It has partial credit. The DoD Assessment Methodology subtracts 5 points if MFA is not implemented and 3 points if it covers remote and privileged users but not general users. A tool that only knows "yes" and "no" will score it wrong.
• It blocks Level 2 (Self). Under 32 CFR 170.21, a conditional Level 2 status allows nothing on the plan of action worth more than 1 point, with one narrow exception for 3.13.11. An open 3.5.3 is a hard stop, and the tool should say so.
• Everyone has a half answer. Most small shops turned on MFA in Microsoft 365 or Google Workspace and stopped. The local administrator account on a laptop and the server console are usually not covered. A good tool catches that. Our post on whether CMMC requires MFA goes deeper.

The five steps, and what good looks like at each

Ask the vendor to set up a sample company that looks like yours: say 15 people, Microsoft 365, two laptops with local admin accounts, one file server, and an outside IT provider who connects remotely. Then ask for each step in order. Take notes in the table at the end of this section.

Step 1: The explanation

Ask: "Show me what this tool tells my office manager about 3.5.3." Good output explains the requirement in plain English, lists the four objectives separately, names the point value (3 or 5), and points out that email MFA does not cover the server console. Weak output pastes the NIST text and stops, or gives a generic paragraph about passwords that could apply to any framework.

Step 2: The SSP paragraph

Ask: "Answer the questions for our sample company, then show me the SSP text it produces for 3.5.3." Requirement 3.12.4 requires an SSP describing how each requirement is implemented, and the DoD methodology treats a missing SSP as an assessment that cannot be completed. Good SSP text names the actual systems (the suite, the remote support tool, the local admin accounts), says which MFA method is used where, and states plainly which objective is not met. Weak text says "The organization employs multifactor authentication in accordance with policy" and names nothing. An assessor reading that will ask the questions the paragraph should have answered. Our SSP template guide shows what each section needs.

Step 3: The policy statement

Ask: "Show me where 3.5.3 lands in the policies." Good output puts MFA in an identification and authentication policy with a clear rule (who must use MFA, for what kind of access, and who approves exceptions) and ties it back to the requirement number. Weak output is a 30-page policy bundle in which the word "multifactor" appears once, or a policy that contradicts the SSP paragraph from step 2.

Step 4: The evidence

Ask: "What would I upload or connect to prove each objective, and how does the tool keep it?" Good output asks for something different per objective: an account list showing privileged accounts for [a], a screenshot or configuration showing the console prompt for [b], the conditional access or enforcement setting for [c] and [d]. It records the date and who supplied it, and it keeps older versions instead of overwriting. Weak output is one upload box per requirement with no guidance on what belongs in it.

This is also the moment to ask where uploaded evidence is stored and who can see it. A screenshot of your admin console is sensitive even if it contains no controlled unclassified information (CUI).

Step 5: The export

Ask: "Export the SSP, the plan of action and the policies right now, and send me the files." Open them after the call. Good output is editable (Word or similar, not only a locked PDF), carries your company name and dates, and reads the same as what you saw in the tool. If the export is only available after a paid upgrade, or the vendor will not send it, you have learned something important about what happens if you ever leave.

Step	Pass	Fail
1. Explanation	Four objectives listed, point value shown, console gap called out	NIST text pasted, no objectives, no scoring
2. SSP paragraph	Names your systems and the MFA method, states any gap	Generic sentence that names nothing
3. Policy	Clear rule, exceptions process, matches the SSP	Buried in boilerplate or contradicts the SSP
4. Evidence	Different evidence per objective, dated, versioned	One upload box, no guidance, overwrites
5. Export	Editable files today, same content as the tool	Locked PDF, paywalled, or "we will send it later"

The trick question: partial MFA

Once the five steps are done, change one answer. Tell the tool that MFA is on for everyone in the suite but not on the server console or the laptop admin accounts. Then watch three things.

1. Status. The requirement should show as not implemented, not "partially implemented" counted as done. Under 32 CFR 170.24 a requirement is MET, NOT MET or NOT APPLICABLE, and it is MET only when every objective is satisfied.
2. Score. The SPRS score should drop by 5, because the methodology's 3-point case is MFA covering remote and privileged users but not general users. Here the privileged local access is the part missing, so the 3-point case does not apply. If the tool subtracts nothing, its scoring logic is wrong in the place that matters most. If it subtracts 3, ask the vendor to show you why.
3. Plan of action. The tool should create a plan of action item for the console gap and warn you that it blocks Level 2 (Self). For SPRS alone, the score can still be posted with a plan of action and a completion date.

You can check any vendor's arithmetic against the free SPRS calculator, which uses the DoD weights.

Red flags to write down

• Every requirement is a single yes or no, with no objectives underneath.
• The demo never leaves the dashboard, or the vendor says documents are "coming in the next release."
• The SSP text is the same for every company that uses the tool.
• The tool calls itself a certification. Software cannot certify you. Right now the three self-assessed paths that matter are CMMC Level 1 (Self), CMMC Level 2 (Self) and the SPRS score, and all three rest on your own judgment, signed by your own official.
• You cannot get a straight answer about where evidence is stored or whether an AI feature sends your content to another provider.
• Pricing depends on a call, or the export sits behind a higher tier.

What to do this week

1. Shortlist two or three tools. Our small-business comparison is a starting point.
2. Send each vendor the sample company description above before the call, so the demo is about your shape, not theirs.
3. Ask for the five steps and the partial MFA trick, in that order. Print the pass/fail table and fill it in live.
4. Ask for the exported files by email and open them the same day.
5. Where a tool has a free tier, run the test yourself without a salesperson in the room.

We hold ourselves to the same test. CMMC Map, CMMC compliance software for small defense contractors, has a free assessment of all 110 requirements and the Level 1 safeguards with a live SPRS score and gap list, no credit card and no trial clock. The generated SSP, plan of action, 14 policies and readiness report are the one paid plan at $149 a month. Try 3.5.3 on it before you talk to anyone, including us.

This is explanatory content, not legal advice. Your contract clauses and your prime's flowdown letter govern what you owe.